Roles hierarchy has no effect in Spring security

[jcheron]

Context

Given the following role hierarchy defined in the Spring security configuration:

    @Bean
    fun roleHierarchy(): RoleHierarchy {
        val roleHierarchy = RoleHierarchyImpl()
        val hierarchy = "ROLE_ADMIN > ROLE_USER"
        roleHierarchy.setHierarchy(hierarchy)
        return roleHierarchy
    }

Given the following authorisations:

http.requestMatchers("/bar/**").hasAuthority("USER")

Expected behaviour

A user with the ROLE_ADMIN role should be able to access the /bar/** urls

Current result

403 Fordidden

Changes

The following changes to the configuration have no effect

    @Bean
    fun webSecurityExpressionHandler(): DefaultWebSecurityExpressionHandler {
        val expressionHandler = DefaultWebSecurityExpressionHandler()
        expressionHandler.setRoleHierarchy(roleHierarchy())
        return expressionHandler
    }

    @Bean
    fun expressionHandler(): DefaultMethodSecurityExpressionHandler {
        val expressionHandler = DefaultMethodSecurityExpressionHandler()
        expressionHandler.setRoleHierarchy(roleHierarchy())
        return expressionHandler
    }

    @Bean
    fun grantedAuthoritiesMapper(roleHierarchy: RoleHierarchy): GrantedAuthoritiesMapper {
        return RoleHierarchyAuthoritiesMapper(roleHierarchy)
    }

Versions

• Java 17 Corretto
• Kotlin 1.7.22
• Springboot 3.0.3
• Spring-security 6.0.2

see https://github.com/spring-projects/spring-security/issues/12473 see https://github.com/spring-projects/spring-security/pull/12505 see https://github.com/vrudas/spring-framework-examples/issues/101